Privacy & Regulation of FinTech & Mobile Wallets in Pakistan — 2025 Guide

Understand how mobile wallets, payment apps, EMIs and PSP/PSOs are regulated, what data they can collect, and the guardrails around onboarding, fees, lending and dispute resolution.

EMI Licensing PSP/PSO e-KYC & AML/CFT Data Protection Consumer Rights Cybersecurity

Jump to: FinTech Landscape • Licensing Types • e-KYC & AML/CFT • Privacy & Data Rules • Cybersecurity • Consumer Protection • Wallet Operations • In-App Lending/BNPL • Tax & Reporting • Breaches & Incidents • FAQ • Useful Tools

Advertisement

1) Pakistan’s FinTech Landscape (quick primer)

Payments are shifting from cash to digital rails. Mobile wallets and payment apps ride on interoperability systems (e.g., instant payment schemes) and bank partnerships. New players typically operate as Electronic Money Institutions (EMIs) or as Payment System Providers/Operators (PSP/PSOs) under central bank oversight.

Goal of regulation: safeguard customer funds, ensure operational resilience, prevent money laundering/terror financing, and protect privacy and consumer rights.

2) Licensing & permissible activities

EMI (Electronic Money Institution)

• Issues and redeems e-money (stored value) via mobile wallets and cards.
• Must ring-fence customer funds in trust/escrow accounts with scheduled banks.
• Supports cash-in/out through agents; enables P2P, bill pay, merchant QR, and remittances (as permitted).
• Restrictions on interest/float use; investment only in approved safe assets.

PSP/PSO (Payment services & switching)

• Provides switching, clearing, and/or merchant acquiring; may operate payment gateways.
• Focus on interoperability, settlement, and network rules with banks/schemes.
• Stringent uptime, reconciliation, and dispute management standards.

FinTechs may also partner with licensed banks or microfinance banks to offer co-branded products under sponsorship agreements.

3) e-KYC, onboarding & AML/CFT essentials

1. Risk-based KYC: Verify identity (CNIC/POC/Passport), face match/live-ness where applicable, and screen against sanctions/watchlists.
2. Tiered wallets: Apply transaction and balance limits by risk tier; escalate due diligence for higher limits.
3. Transaction monitoring: Rules for structuring, mule activity, rapid cash-out, and unusual patterns; alert reviews and SAR/STR filing.
4. Agent due diligence: Vet and train retail agents; periodic audits and mystery shopping.
5. Record-keeping: Keep KYC/transaction data for the prescribed retention period; ensure secure access controls.

Red flags: multiple wallets per identity, device hopping, high-velocity transfers after top-ups, and frequent cross-border micro-transactions without purpose codes.

4) Privacy & data handling rules

• Lawful basis & consent: Collect only the data necessary for the service; obtain clear consent for marketing and analytics.
• Purpose limitation: Do not repurpose KYC data for profiling without explicit consent and legal basis.
• Transparency: Publish readable privacy notices covering categories of data, sharing, retention, and user rights.
• Data sharing: Contracts with processors (cloud, analytics, SMS) must bind confidentiality, security, sub-processor controls, and breach notification timelines.
• Cross-border transfers: Assess adequacy, use standard clauses, and keep data maps and DPIAs for international flows.
• User rights: Access/correction, marketing opt-out, and account closure with timely data deletion (subject to legal retention).

5) Cybersecurity & operational resilience

Control	What to implement	Outcome
Authentication	MFA, device binding, step-up for risky actions, PIN retry limits.	Reduces account takeover.
Encryption	TLS in transit; strong encryption at rest; HSM/KMS for keys.	Protects sensitive data.
Fraud engines	Velocity checks, geofencing, behavioral analytics, SIM-swap signals.	Early fraud detection.
Change management	Peer review, segregation of duties, canary releases, rollback plans.	Stable releases.
BCP/DR	RTO/RPO targets, offsite backups, regular failover drills.	Service continuity.
Vulnerability testing	Secure SDLC, SAST/DAST, pentests and bug bounty intake.	Fewer exploitable flaws.

6) Consumer protection & disclosures

• Transparent pricing: Display fees before confirmation; give digital receipts and monthly statements.
• Chargebacks & disputes: Clear timelines for acknowledgment and resolution; escalation routes to ombudsman/regulator.
• Cooling-off & consent: Easy cancellation for recurring mandates and data-sharing consents.
• Accessibility: Urdu/English support, IVR and in-app chat; inclusive UI for low-literacy users.
• Vulnerable customers: Extra checks for seniors and first-time smartphone users; scam education banners.

If you are a user: Never share OTP/PIN. Enable fingerprint/face unlock and set a strong device passcode. In case of loss, block SIM and wallet immediately.

7) How mobile wallets should operate (good practice)

1. Interoperability: Support instant transfers to banks/wallets; show receiving party name before send.
2. Merchant QR: Static/dynamic QR with itemized receipts; dispute button on transaction screen.
3. Safeguard funds: Daily reconciliation of trust accounts; independent trustee oversight.
4. Limit management: Real-time checks on daily/monthly caps; alerts when nearing limits.
5. Dormant accounts: Identify inactivity, notify users, and follow rules for escheatment/refund.

8) In-app lending & BNPL

• Offer credit only via licensed lenders or under explicit regulatory permissions.
• Show APR, fees, total payable before acceptance; provide Key Facts Statement.
• No dark patterns: pre-ticked boxes, hidden insurance, or penalty traps.
• Collections: comply with fair-debt conduct; no harassment or contact-list scraping.
• Credit decisioning: keep model documentation and allow error correction/dispute of automated assessments.

9) Tax & reporting touchpoints

• Withholdings on merchant settlements where applicable; issue certificates and summaries.
• Maintain transaction logs for audits; reconcile fees, MDR, interchange, and chargebacks.
• Remittances: ensure correct purpose codes, sanctions screening, and reporting via authorized channels.

10) Breaches, scams & incident response

• Publish a 24/7 fraud hotline and in-app “Report fraud” button.
• Freeze suspect transactions quickly; coordinate with banks and law enforcement.
• Notify users and authorities per policy; provide remediation (refunds where appropriate).
• Run post-incident reviews; update rules, educate users, and patch root causes.

Common scams: fake prize OTP, screen-sharing traps, SIM-swap, QR-code pull payments, and spoofed support calls.

Advertisement

FAQ — quick answers

Is my money safe in a mobile wallet?

Customer funds are held in safeguarded accounts and separated from the company’s own money. Check that your provider is properly licensed and publishes safeguarding details.

What data can a wallet app collect?

Only what is necessary for onboarding, security, and transactions. Marketing or analytics data needs clear consent and an easy opt-out.

Where can I complain about an unauthorized transaction?

Raise an in-app ticket immediately and request chargeback/investigation. If unresolved, escalate to the bank partner or the relevant ombudsman/regulator per the provider’s policy.

Can wallets lend directly?

Only if they are licensed to do so or partner with a licensed lender. Users should receive a Key Facts Statement before taking any loan.

Useful tools & internal links

Draft a complaint, compute fees, and learn your rights using these resources:

Open Legal Toolkit Online Consumer Complaint Form Cybercrime Complaint Assistant Court Fee Calculator Stamp Duty Calculator

Disclaimer: This guide is for general information in 2025. Always follow the latest circulars, rules, and instructions issued by the relevant authorities and your provider’s official policy.

```0